EUVD-2026-95401

A flaw was found in Eye of GNOME eog. A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to...

EUVD-2026-95330

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS Microsoft SQL Server PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or...

EUVD-2026-95329

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow...

EUVD-2026-95326

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow...

EUVD-2026-95323

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow...

EUVD-2026-95332

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow...

EUVD-2026-95339

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal...

Malicious code in pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...

ROS-20261009-73-0091

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-20261009-73-0542

The vulnerability in the kernel-lt is related to integer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code...

ROS-20261009-73-0530

The vulnerability in the kernel-lt is related to integer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code...

ROS-20261009-73-0458

The vulnerability in the kernel-lt is related to insufficient control of resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261009-73-0410

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-20261009-73-0106

The vulnerability in the kernel-lt is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-108723

Name of the Vulnerable Software and Affected Versions FalkorDB versions prior to 4.18.1 Description A double free and use-after-free issue exists in the RdbLoadDeletedNodes function of the RDB graph decoders. A remote attacker capable of issuing Redis replication commands can trigger a denial of...

PT-2026-108906

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, an...

Redis 5.0.7 Lua Sandbox Escape

Redis version 5.0.7 as packaged by Debian and Ubuntu leaves the Lua package global accessible, allowing EVAL scripts to load Lua's io module and execute host commands. The supplied environment and proof of concept demonstrate CVE-2022-0543. https://packetstorm.news/download/234982...

Spring Data Commons 2.0.5 SpEL Injection

Spring Data Commons version 2.0.5 contains a SpEL injection issue in web data binding that can allow crafted request parameter names to execute commands. This proof of concept provides a vulnerable containerized application and demonstration. https://packetstorm.news/download/234975...

Spring Cloud Function 3.2.2 SpEL Injection

Spring Cloud Function version 3.2.2 evaluates the spring.cloud.function.routing-expression request header as a SpEL expression. The supplied proof of concept demonstrates target-side command execution. https://packetstorm.news/download/234973...

PT-2026-108982

Name of the Vulnerable Software and Affected Versions busybox affected versions not specified Description The tar applet contains a flaw in its deferred link-creation handling for symlink and hardlink entries with unsafe targets. The software fails to validate that the resolved destination remain...